EUVD-2026-79368
GHSA-4rq9-76h3-6w88
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 3.1 base score is 9.6 (Critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - remote, low-complexity, unauthenticated (PR:N), but crucially requires human interaction (UI:R) from a person other than the attacker, and involves a scope change (S:C) into additional products with full confidentiality/integrity/availability impact (takeover). The UI:R requirement is the single most important limiter: unlike its no-interaction, pre-auth CPU sibling CVE-2026-83021 (10.0) or the S:U WebCenter Sites pre-auth flaws (9.8), this vulnerability cannot be triggered purely by an attacker acting alone - a victim must perform some action, which meaningfully reduces automatability and mass-exploitation likelihood despite the near-maximal score. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so there is no evidence of active exploitation - this is exploitation status 'no public exploit identified at time of analysis.' Net: this is a genuine high-priority patch item (pre-auth, network SOAP, full takeover, scope change) but the UI:R gate places its realistic weaponization slightly below the no-interaction siblings in the same Oracle September 2026 CPU. Oracle publishes zero technical detail (no endpoint, no CWE, no vector-into-parameter specifics), so exploit engineering effort is currently unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 via a SOAP-based attack, but exploitation requires a user to interact with a malicious element (UI:R). This critical-severity issue (CVSS 9.6) has a scope change that can impact additional products beyond WebCenter Portal. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Patch status: not confirmed from available data; consult the Oracle security advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and specific update instructions. If a patch is not yet available, consider the following compensating controls: Restrict network access to the SOAP endpoint used by WebCenter Portal Portlet Services to trusted IP ranges only, though this may limit legitimate portal functionality. Because exploitation requires user interaction (UI:R), implement user awareness training to recognize and avoid suspicious links or content, and consider browser-based protections or email filtering to reduce the risk of successful social engineering; note that these measures are not foolproof and may have usability impacts. Given the scope change (S:C), ensure that other products in the same security domain are isolated and monitored for anomalous activity. The unauthenticated nature (PR:N) means that authentication controls alone will not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Portal is part of Oracle Fusion Middleware, providing enterprise portal and composite application capabilities. The vulnerability resides in the Portlet Services component, which handles communication between the portal and portlets, likely using SOAP over network. The attack vector is network-accessible SOAP, and the CVSS vector indicates low attack complexity (AC:L) and no privileges required (PR:N). However, the UI:R metric indicates that successful exploitation depends on a user other than the attacker performing some action, such as clicking a link or visiting a page. The scope change (S:C) means the vulnerability in WebCenter Portal can affect resources beyond its security scope, potentially compromising other products in the deployment. The root cause class is not specified (CWE: N/A), but the combination of unauthenticated network access and required user interaction suggests a possible client-side execution or request forgery vector that can pivot to other components.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are affected by a critical vulnerability that could allow an attacker to gain full takeover of the portal, potentially leading to data breaches, service disruption, and lateral movement into connected systems. Despite requiring user interaction for exploitation, the absence of a vendor patch and the potential for scope change to other products elevate the risk. No public exploit has been identified at time of analysis, but leadership should prioritize immediate mitigation and monitoring to protect business operations.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to SOAP endpoints, disabling SOAP services if not required, implementing WAF rules to detect and block malicious SOAP traffic, and enforcing user awareness training to reduce successful user interaction with malicious elements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB